Overview

overview

10

Static

static

ord_482.docm

windows7_x64

10

ord_482.docm

windows10-2004_x64

10
General
Target

ord_482.docm

Filesize

266KB

Completed

21-05-2022 10:46

Task

behavioral1

Score
10/10
MD5

bf61de5c8c5da0b79f0fccca3c4f5e04

SHA1

ce568d2e8d9c1c86a8caf54bbaa85b80984b5cbe

SHA256

eee5599e3d990a109e7346469d8739d184628192831144da80e69244ebdb19d0

SHA512

a55fc8f2bc6cb96c730331a9bd4d5a46a86008f7ed0b09b5c587246a8a370dba01e0227926aa01ab590b3df1fb7662d48c5b2966a651d05a7fe32bc5208379e8

Malware Config

Extracted

Family

icedid
C2

3chickens.pw
Signatures 11

Filter: none

Defense Evasion
  • IcedID, BokBot

    Description

    IcedID is a banking trojan capable of stealing credentials.

    Tags

  • IcedID First Stage Loader

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/336-62-0x0000000000240000-0x0000000000246000-memory.dmpIcedidFirstLoader
    behavioral1/memory/336-66-0x0000000000020000-0x0000000000023000-memory.dmpIcedidFirstLoader
  • Executes dropped EXE
    Dwpeokfds.exe

    Reported IOCs

    pidprocess
    336Dwpeokfds.exe
  • Drops file in Windows directory
    WINWORD.EXE

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\Debug\WIA\wiatrace.logWINWORD.EXE
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings
    WINWORD.EXE

    Tags

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\editWINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML EditorWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\editWINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMANDWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\ToolbarWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNoteWINWORD.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft ExcelWINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shellWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\commandWINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""WINWORD.EXE
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000WINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMANDWINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"WINWORD.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shellWINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"WINWORD.EXE
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000WINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\editWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\editWINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shellWINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML EditorWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExtWINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shellWINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML EditorWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\commandWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML EditorWINWORD.EXE
  • Modifies registry class
    WINWORD.EXE

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\editWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"WINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\commandWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\TypeLib\{C0941F2C-F54C-4B49-B5AD-0803BA33AAF9}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents"WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexecWINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\editWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\commandWINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"WINWORD.EXE
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage"WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIconWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\commandWINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents"WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexecWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\TypeLib\{C0941F2C-F54C-4B49-B5AD-0803BA33AAF9}\2.0\FLAGSWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\commandWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft ExcelWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}WINWORD.EXE
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C0941F2C-F54C-4B49-B5AD-0803BA33AAF9}\2.0\FLAGS\ = "6"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden"WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\PrintWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\applicationWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}WINWORD.EXE
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\applicationWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C0941F2C-F54C-4B49-B5AD-0803BA33AAF9}\2.0WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents"WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden"WINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\commandWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exeWINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect"WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents"WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\TypeLib\{C0941F2C-F54C-4B49-B5AD-0803BA33AAF9}\2.0\0\win32WINWORD.EXE
  • Suspicious behavior: AddClipboardFormatListener
    WINWORD.EXE

    Reported IOCs

    pidprocess
    1228WINWORD.EXE
  • Suspicious use of FindShellTrayWindow
    WINWORD.EXE

    Reported IOCs

    pidprocess
    1228WINWORD.EXE
    1228WINWORD.EXE
  • Suspicious use of SetWindowsHookEx
    WINWORD.EXE

    Reported IOCs

    pidprocess
    1228WINWORD.EXE
    1228WINWORD.EXE
  • Suspicious use of WriteProcessMemory
    WINWORD.EXE

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1228 wrote to memory of 15881228WINWORD.EXEsplwow64.exe
    PID 1228 wrote to memory of 15881228WINWORD.EXEsplwow64.exe
    PID 1228 wrote to memory of 15881228WINWORD.EXEsplwow64.exe
    PID 1228 wrote to memory of 15881228WINWORD.EXEsplwow64.exe
Processes 3
  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ord_482.docm"
    Drops file in Windows directory
    Modifies Internet Explorer settings
    Modifies registry class
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      PID:1588
  • \??\c:\filelogger\Dwpeokfds.exe
    c:\filelogger\Dwpeokfds.exe
    Executes dropped EXE
    PID:336
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads

                        • C:\filelogger\Dwpeokfds.exe

                          MD5

                          595dbd6bc516042c44c30e809e9fd999

                          SHA1

                          cad305ce9097168c021f9098d5ed88c7e5245c32

                          SHA256

                          7a6246028972eb47a29923f907152935c24e91a9e3df714b3673beac818bfac9

                          SHA512

                          4ed8843919e0ae646e80ce1a6d4adca616e57758f1f30bd3e04261c4d27ea7d9abe7ad5348ad9f2430a56739279dc0ce03bd10d6366119f5f6c88cb600812e1c

                          Download Submit

                        • memory/336-62-0x0000000000240000-0x0000000000246000-memory.dmp

                          Download

                        • memory/336-66-0x0000000000020000-0x0000000000023000-memory.dmp

                          Download

                        • memory/1228-54-0x0000000072361000-0x0000000072364000-memory.dmp

                          Download

                        • memory/1228-57-0x00000000751C1000-0x00000000751C3000-memory.dmp

                          Download

                        • memory/1228-67-0x000000005FFF0000-0x0000000060000000-memory.dmp

                          Download

                        • memory/1228-55-0x000000006FDE1000-0x000000006FDE3000-memory.dmp

                          Download

                        • memory/1228-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

                          Download

                        • memory/1228-65-0x000000006AAB1000-0x000000006AAB3000-memory.dmp

                          Download

                        • memory/1228-58-0x0000000070DCD000-0x0000000070DD8000-memory.dmp

                          Download

                        • memory/1588-60-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

                          Download

                        • memory/1588-59-0x0000000000000000-mapping.dmp

                          Download